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Despite recent advances in uncovering the quantitative features of stationary hu- 
man activity patterns, many applications, from pandemic prediction to emer- 
gency response, require an understanding of how these patterns change when 
the population encounters unfamiliar conditions. To explore societal response 
to external perturbations we identified real-time changes in communication and 
mobility patterns in the vicinity of eight emergencies, such as bomb attacks and 
earthquakes, comparing these with eight non-emergencies, like concerts and sport- 
ing events. We find that communication spikes accompanying emergencies are 
both spatially and temporally localized, but information about emergencies spreads 
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globally, resulting in communication avalanches that engage in a significant man- 
ner the social network of eyewitnesses. These results off'er a quantitative view of 
behavioral changes in human activity under extreme conditions, with potential 
long-term impact on emergency detection and response. 

Introduction 

Current research on human dynamics is limited to data collected under normal and stationary 
circumstances [HI, capturing the regular daily activity of individuals ll2ll2ll4ll5l[3l[n[8ll9l [T0lfTn 
[T2I [T3l [T4l [T5l . Yet, there is exceptional need to understand how people change their behavior 
when exposed to rapidly changing or unfamiliar conditions [[U, such as life-threatening epidemic 
outbreaks IH [T2||, emergencies and traffic anomalies, as models based on stationary events are 
expected to break down under these circumstances. Such rapid changes in conditions are often 
caused by natural, technological or societal disasters, from hurricanes to violent conflicts fil6il . 
The possibility to study such real time changes has emerged recently thanks to the widespread 
use of mobile phones, which track both user mobility E |2l |3l [171 and real-time communications 
along the links of the underlying social network [[BIIll- Here we take advantage of the fact that 
mobile phones act as in situ sensors at the site of an emergency, to study the real-time behavioral 
patterns of the local population under external perturbations caused by emergencies. Advances 
in this direction not only help redefine our understanding of information propagation (19] and 
cooperative human actions under externally induced perturbations, which is the main motivation 
of our work, but also offer a new perspective on panic [|20l [2T1 122[ [23ll and emergency protocols in 
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a data-rich environment [|24l . 

Our starting point is a country-wide mobile communications dataset, culled from the anonymized 
billing records of approximately ten million mobile phone subscribers of a mobile company which 
covers about one-fourth of subscribers in a country with close to full mobile penetration. It pro- 
vides the time and duration of each mobile phone call [IJ, together with information on the tower 
that handled the call, thus capturing the real-time locations of the users [|2l|3l|25j| (Methods, Sup- 
porting Liformation SI, Fig. A). To identify potential societal perturbations, we scanned media 
reports pertaining to the coverage area between January 2007 and January 2009 and developed a 
corpus of times and locations for eight societal, technological, and natural emergencies, ranging 
from bombings to a plane crash, earthquakes, floods and storms (Table 1). Approximately 30% 
of the events mentioned in the media occurred in locations with sparse cellular coverage or during 
times when few users are active (like very early in the morning). The remaining events do offer, 
however, a sufficiently diverse corpus to explore the generic vs. unique changes in the activity 
patterns in response to an emergency. Here we discuss four events, chosen for their diversity: (1) 
a bombing, resulting in several injuries (no fatalities); (2) a plane crash resulting in a significant 
number of fatalities; (3) an earthquake whose epicenter was outside our observation area but af- 
fected the observed population, causing mild damage but no casualties; and (4) a power outage 
(blackout) affecting a major metropolitan area (Supporting Information SI, Fig. B). To distinguish 
emergencies from other events that cause collective changes in human activity, we also explored 
eight planned events, such as sports games and a popular local sports race and several rock con- 
certs. We discuss here in detail a cultural festival and a large pop music concert as non-emergency 
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references (Table 1, see also Supporting Information SI, Sec. B). The characteristics of the events 
not discussed here due to length limitations are provided in Supporting Information SI, Sec. I for 
completeness and comparison. 



Results and Discussion 



As shown in Fig. lA, emergencies trigger a sharp spike in call activity (number of outgoing calls 
and text messages) in the physical proximity of the event, confirming that mobile phones act as 
sensitive local "sociometers" to external societal perturbations. The call volume starts decaying 
immediately after the emergency, suggesting that the urge to communicate is strongest right at the 
onset of the event. We see virtually no delay between the onset of the event and the jump in call 
volume for events that were directly witnessed by the local population, such as the bombing, the 
earthquake and the blackout. Brief delay is observed only for the plane crash, which took place 
in an unpopulated area and thus lacked eyewitnesses. In contrast, non-emergency events, hke the 
festival and the concert in Fig. |lA[ display a gradual increase in call activity, a noticeably different 
pattern from the "jump-decay" pattern observed for emergencies. See also Supporting Information 
SI, Figs. I and J. 



To compare the magnitude and duration of the observed call anomalies, in Fig. IB we show 
the temporal evolution of the relative call volume AVj (Vnormai) as a function of time, where AV = 
Kvent - (Kormai), Kvent is the Call activity during the event and (Vnormai) is the average call activity 



during the same time period of the week. As Fig. IB indicates, the magnitude of AVj (Vnormai) 



correlates with our relative (and somewhat subjective) sense of the event's potential severity and 



unexpectedness: the bombing induces the largest change in call activity, followed by the plane 
crash; whereas the collective reaction to the earthquake and the blackout are somewhat weaker 
and comparable to each other. While the relative change was also significant for non-emergencies, 
the emergence of the call anomaly is rather gradual and spans seven or more hours, in contrast 



with the jump-decay pattern lasting only three to five hours for emergencies (Figs. IB Supporting 



Information SI, Figs. I and J). As we show in Fig. IC (see also Supporting Information SI, Sec. C) 



the primary source of the observed call anomaly is a sudden increase of calls by individuals who 
would normally not use their phone during the emergency period, rather than increased call volume 
by those that are normally active in the area. 

The temporally localized spike in call activity (Fig. 1A|B I raises an important question: is in- 



formation about the events limited to the immediate vicinity of the emergency or do emergencies, 
often immediately covered by national media, lead to spatially extended changes in call activ- 
ity [|23]| ? We therefore inspected the change in call activity in the vicinity of the epicenter, finding 
that for the bombing, for example, the magnitude of the call anomaly is strongest near the event. 



and drops rapidly with the distance r from the epicenter (Fig. lA). To quantify this eff"ect across 



all emergencies, we integrated the call volume over time in concentric shells of radius r centered 



on the epicenter (Fig. IB ). The decay is approximately exponential, AV{r) ~ exp {-r/r^), allowing 



us to characterize the spatial extent of the reaction with a decay rate rc (Fig. [TCj ). The observed 
decay rates range from 2 km (bombing) to 10 km (plane crash), indicating that the anomalous call 
activity is limited to the event's vicinity. An extended spatial range (rc ~ 110 km) is seen only 
for the earthquake, lacking a narrowly defined epicenter. Meanwhile, a distinguishing pattern of 
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non-emergencies is their highly localized nature: they are characterized by a decay rate of less than 
2 km, implying that the call anomaly was narrowly confined to the venue of the event. This sys- 
tematic split in Tc between the spatially extended emergencies and well-localized non-emergencies 
persists for all explored events (see Table 1, Supporting Information SI, Fig. K). 

Despite the clear temporal and spatial localization of anomalous call activity during emergen- 
cies, one expects some degree of information propagation beyond the eyewitness population [26] . 
We therefore identified the individuals located within the event region (Go), as well as a Gi group 
consisting of individuals outside the event region but who receive calls from the Go group during 
the event, a G2 group that receive calls from Gi, and so on. We see that the Go individuals engage 
their social network within minutes, and that the Gi, G2, and occasionally even the G3 group show 



an anomalous call pattern immediately after the anomaly (Fig. lA). This effect is quantified in 



Fig. IB , where we show the increase in call volume for each group as a function of their social 
network based distance from the epicenter (for example, the social distance of the G2 group is 
2, being two links away from the Gq group), indicating that the bombing and plane crash show 
strong, immediate social propagation up to the third and second neighbors of the eyewitness Gq 
population, respectively. The earthquake and blackout, less threatening emergencies, show little 
propagation beyond the immediate social links of Gq and social propagation is virtually absent in 
non-emergencies. 



The nature of the information cascade behind the results shown in Fig. 1A|B is illustrated in 



Fig. IC, where we show the individual calls between users active during the bombing. In con- 



trast with the information cascade triggered by the emergencies witnessed by the Gq users, there 
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are practically no calls between the same individuals during the previous week. To quantify the 
magnitude of the information cascade we measured the length of the paths emanating from the Go 
users, finding them to be considerably longer during the emergency (Fig. |1D| ), compared to five 
non-emergency periods, demonstrating that the information cascade penetrates deep into the social 
network, a pattern that is absent during normal activity [|27]| . See also Supporting Information SI, 
Figs. E, F, G, H, L, M, N, and O, and Table A. 

The existence of such prominent information cascades raises tantalizing questions about who 
contributes to information propagation about the emergency. Using self -reported gender informa- 
tion available for most users (see Supporting Information SI), we find that during emergencies 
female users are more likely to make a call than expected based on their normal call patterns. This 
gender discrepancy holds for the Go (eyewitness) and Gi groups, but is absent for non-emergency 
events (see Supporting Information SI, Sec. E, Fig. C). We also separated the total call activity of 
Go and Gi individuals into voice and text messages (including SMS and MMS). For most events 
(the earthquake and blackout being the only exceptions), the voice/text ratios follow the normal 
patterns (Supporting Information SI, Fig. D), indicating that users continue to rely on their pre- 
ferred means of communication during an emergency. 

The patterns identified discussed above allow us to dissect complex events, such as an explosion 
in an urban area preceded by an evacuation starting approximately one hour before the blast. While 
a call volume anomaly emerges right at the start of the evacuation, it levels off and the jump-decay 



pattern characteristic of an emergency does not appear until the real explosion (Fig. lA). The 



spatial extent of the evacuation response is significantly smaller than the one observed during the 



7 



event {r^ = 1.6 for the evacuation compared with = 9.0 for the explosion, see Fig.|lB[). During 



the evacuation, social propagation is limited to the Go and Gi groups only (Fig. 1C|D ) while after 



the explosion we observe a communication cascade that activates the G2 users as well. The lack 
of strong propagation during evacuation indicates that individuals tend to be reactive rather than 
proactive and that a real emergency is necessary to initiate a communication cascade that effectively 
spreads emergency information. 



The results of Figs. ?? ?? not only indicate that the collective response of the population to 
an emergency follows reproducible patterns common across diverse events, but they also docu- 
ment subtle differences between emergencies and non-emergencies. We therefore identified four 
variables that take different characteristic values for emergencies and non-emergencies: (i) the 
midpoint fraction /mid = (?mid - ^start) / (^stop - ^start), vvhere ?start and ?stop are the times when the 
anomalous activity begins and ends, respectively, and tmid is the time when half of the total anoma- 
lous call volume has occurred; (ii) the spatial decay rate capturing the extent of the event; (iii) 
the relative size R of each information cascade, representing the ratio between the number of users 
in the event cascade and the cascade tracked during normal periods; (iv) the probability for users 
to contact existing friends (instead of placing calls to strangers). 

In Fig. [??]we show these variables for all 16 events, finding systematic differences between 
emergencies and non-emergencies. As the figure indicates, a multidimensional variable, relying 
on the documented changes in human activity, can be used to automatically distinguish emergency 
situations from non-emergency induced anomalies. Such a variable could also help real-time mon- 
itoring of emergencies [|24ll . from information about the size of the affected population, to the 
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timeline of the events, and could help identify mobile phone users capable of offering immediate, 
actionable information, potentially aiding search and rescue. 

Rapidly-evolving events such as those studied throughout this work require dynamical data 
with ultra-high temporal and spatial resolution and high coverage. Although the populations af- 
fected by emergencies are quite large, occasionally reaching thousands of users, due to the demon- 
strated localized nature of the anomaly, this size is still small in comparison to other proxy studies 
of human dynamics, which can exploit the activity patterns of millions of internet users or web- 
pages [m [151 123 . Meanwhile, emergencies occur over very short timespans, a few hours 
at most, whereas much current work on human dynamics relies on longitudinal datasets covering 
months or even years of activity for the same users (e.g. [|2l[3l|9l), integrating out transient events 
and noise. But in the case of emergencies, such transient events are precisely what we wish to 
quantify. Given the short duration and spatially localized nature of these events, it is vital to have 
extremely high coverage of the entire system, to maximize the availability of critical information 
during an event. To push human dynamics research into such fast-moving events requires new 
tools and datasets capable of extracting signals from limited data. We believe that our research 
offers a first step in this direction. 

In summary, similar to how biologists use drugs to perturb the state of a cell to better under- 
stand the collective behavior of living systems, we used emergencies as external societal pertur- 
bations, helping us uncover generic changes in the spatial, temporal and social activity patterns of 
the human population. Starting from a large-scale, country-wide mobile phone dataset, we used 
news reports to gather a corpus of sixteen major events, eight unplanned emergencies and eight 



9 



scheduled activities. Studying the call activity patterns of users in the vicinity of these events, we 
found that unusual activity rapidly spikes for emergencies in contrast with non-emergencies in- 
duced anomalies that build up gradually before the event; that the call patterns during emergencies 
are exponentially localized regardless of event details; and that affected users will only invoke the 
social network to propagate information under the most extreme circumstances. When this social 
propagation does occur, however, it takes place in a very rapid and efficient manner, so that users 
three or even four degrees from eyewitnesses can learn of the emergency within minutes. 

These results not only deepen our fundamental understanding of human dynamics, but could 
also improve emergency response. Indeed, while aid organizations increasingly use the distributed, 
real-time communication tools of the 21st century, much disaster research continues to rely on 
low-throughput, post-event data, such as questionnaires, eyewitness reports Il28ll29l , and commu- 
nication records between first responders or relief organizations ll30ll . The emergency situations 
explored here indicate that, thanks to the pervasive use of mobile phones, collective changes in hu- 
man activity patterns can be captured in an objective manner, even at surprisingly short time-scales, 
opening a new window on this neglected chapter of human dynamics. 

Materials and Methods 
Dataset 

We use a set of anonymized billing records from a western european mobile phone service provider [HI 
|2l |3l. The records cover approximately lOM subscribers within a single country over 3 years of 
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activity. Each billing record, for voice and text services, contains the unique identifiers of the caller 
placing the call and the callee receiving the call; an identifier for the cellular antenna (tower) that 
handled the call; and the date and time when the call was placed. Coupled with a dataset describing 
the locations (latitude and longitude) of cellular towers, we have the approximate location of the 
caller when placing the call. For full details, see Supporting Information SI, Sec. A. 

Identifying events 

To find an event in the mobile phone data, we need to determine its time and location. We have 
used onUne news aggregators, particularly the local news . google . com service to search for news 
stories covering the country and time frame of the dataset. Keywords such as 'storm', 'emergency', 
'concert', etc. were used to find potential news stories. Important events such as bombings and 
earthquakes are prominently covered in the media and are easy to find. Study of these reports, 
which often included photographs of the affected area, typically yields precise times and locations 
for the events. Reports would occasionally conflict about specific details, but this was rare. We 
take the reported start time of the event as f = 0. 

To identify the beginning and ending of an event, ^start and ?stop. we adopt the following proce- 
dure. First, identify the event region (a rough estimate is sufficient) and scan all its calls during 
a large time period covering the event (e.g., a full day), giving Vevent(0- Then, scan calls for a 
number of "normal" periods, those modulo one week from the event period, exploiting the weekly 
periodicity of ^(0- These normal periods' time series are averaged to give (Vnormai)- (To smooth 
time series, we typically bin them into 5-10 minute intervals.) The standard deviation a ( Vnormai) as 
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a function of time is then used to compute z{t) = ^V(0/c (^normal)- Finally, we define the interval 
(^start, ^stop) as the longest contiguous run of time intervals where z{t) > Zthr, for some fixed cutoff" 
Zthr- We chose Zthr = 1-5 for all events. 

For full details, see Supporting Information SI, Sec. B. 

Acknowledgments 

The authors thank A. Pawling, F. Simini, M. C. Gonzalez, S. Lehmann, R. Menezes, N. Blumm, 
C. Song, J. P. Huang, Y.-Y. Ahn, P. Wang, R. Crane, D. Somette, and D. Lazer for many useful 
discussions. 

References 

[1] Vespignani A (2009) Predicting the Behavior of Techno-Social Systems. Science 325: 425- 
428. 

[2] Brockmann D, Hufnagel L, Geisel T (2006) The scaling laws of human travel. Nature 439: 
462^65. 

[3] Gonzalez MC, Hidalgo CA, Barabasi AL (2008) Understanding individual human mobility 
patterns. Nature 453: 779-782. 

[4] Eubank S, Guclu H, Kumar VSA, Marathe MV, Srinivasan A, et al. (2004) Modelling disease 
outbreaks in realistic urban social networks. Nature 429: 180-184. 

[5] Lazer D, Pentland A, Adamic L, Aral S, Barabasi AL, et al. (2009) Computational Social 
Science. Science 323: 721-723. 

[6] Song C, Qu Z, Blumm N, Barabasi AL (2010) Limits of Predictability in Human Mobility. 
Science 327: 1018-1021. 

[7] Onnela JP, Saramaki J, Hyvonen J, Szabo G, Lazer D, et al. (2007) Structure and tie strengths 
in mobile communication networks. Proceedings of the National Academy of Sciences 104: 
7332-7336. 



12 



[8] Gabrielli A, Caldarelli G (2009) Invasion percolation and the time scaling behavior of a queu- 
ing model of human dynamics. Journal of Statistical Mechanics: Theory and Experiment 
2009: P02046. 

[9] Rybski D, Buldyrev SV, Havlin S, Liljeros F, Makse HA (2009) Scaling laws of human 
interaction activity. Proceedings of the National Academy of Sciences 106: 12640-12645. 

[10] Singer HM, Singer I, Herrmann HJ (2009) Agent-based model for friendship in social net- 
works. Phys Rev E 80: 026113. 

[11] Hufnagel L, Brockmann D, Geisel T (2004) Forecast and control of epidemics in a globalized 
world. Proceedings of the National Academy of Sciences of the United States of America 
101: 15124-15129. 

[12] Colizza V, Barrat A, Barthelemy M, Vespignani A (2006) The role of the airline transportation 
network in the prediction and predictability of global epidemics. Proceedings of the National 
Academy of Sciences of the United States of America 103: 2015-2020. 

[13] Wu F, Huberman B (2007) Novelty and collective attention Proceedings of the National 
Academy of Sciences of the United States of America 104: 17599-17601. 

[14] Gongalves B, Ramasco J (2008) Human dynamics revealed through Web analytics Phys Rev 
E 78: 026123. 

[15] Ratkiewicz J, Fortunato S, Flammini A, Menczer F, and Vespignani A (2010) Characterizing 
and Modeling the Dynamics of Online Popularity. Phys Rev Lett 105: 158701. 

[16] Bohorquez J, Gourley S, Dixon A, Spagat M, Johnson N (2009) Common ecology quantifies 
human insurgency. Nature 462: 911-914. 

[17] Balcan D, Colizza V, Gon9alves B, Hu H, Ramasco JJ, et al. (2009) Multiscale mobility net- 
works and the spatial spreading of infectious diseases. Proceedings of the National Academy 
of Sciences 106: 21484-21489. 

[18] Caldarelli G (2007) Scale-Free Networks. Oxford University Press. 

[19] Centola D (2010) The Spread of Behavior in an Online Social Network Experiment. Science 
329: 1194-1197. 

[20] Helbing D, Farkas I, Vicsek T (2000) Simulating dynamical features of escape panic. Nature 
407: 487^90. 

[21] Kaplan EH, Craft DL, Wein LM (2002) Emergency response to a smallpox attack: The case 
for mass vaccination. Proceedings of the National Academy of Sciences of the United States 
of America 99: 10935-10940. 

[22] Helbing D, Johansson A, Mathiesen J, Jensen MH, Hansen A (2006) Analj^ical approach to 
continuous and intermittent bottleneck flows. Phys Rev Lett 97: 168001. 



13 



[23] Petrescu-Prahova M, Butts CT (2008) Emergent coordinators in the World Trade Center dis- 
aster. International Journal of Mass Emergencies and Disasters 28: 133-168. 

[24] Kapoor A, Eagle N, Horvitz E (2010) People, quakes, and communications: Inferences from 
call dynamics about a seismic event and its influences on a population. In: Proceedings of 
AAAI Artificial Intelligence for Development (AI-D'IO). pp. 51-56. 

[25] Lambiotte R, Blondel VD, de Kerchove C, Huens E, Prieur C, et al. (2008) Geographical 
dispersal of mobile communication networks. Physica A 387: 5317 - 5325. 

[26] Crane R, Somette D (2008) Robust dynamic classes revealed by measuring the response 
function of a social system. Proceedings of the National Academy of Sciences 105: 15649- 
15653. 

[27] Onnela IP, Reed-Tsochas F (2010) Spontaneous emergence of social influence in online sys- 
tems. Proceedings of the National Academy of Sciences. 

[28] Sheetz S, Kavanaugh AL, Quek F, Kim BJ, Lu SC (2010) The expectation of connectedness 
and cell phone use in crises. Journal of Emergency Management. 

[29] Rodriguez H, Quarantelli EL, Dynes R, editors (2006) Handbook of Disaster Research. 
Springer, 1st edition. 

[30] Lind BE, Tirado M, Butts CT, Petrescu-Prahova M (2008) Brokerage roles in disaster re- 
sponse: Organizational mediation in the wake of Hurricane Katrina. International Journal of 
Emergency Management 5: 75-99. 



14 



Table 1 : Summary of the studied emergencies and non-emergencies. The columns provide the 
duration of the anomalous call activity (Fig. 1), the spatial decay rate (Fig. 2), the number of users 
in the event population |Go|, and the total size of the information cascade 2; \Gi\ (Fig. 3). Events 
discussed in the main text are italicized, the rest are discussed in the supplementary material. 'Jet 
scare' refers to a sonic boom interpreted by the local population and initial media reports as an 
explosion. 
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Call anomalies during emergencies. |A] The time dependence of call volume V(t) in the vicinity 
of four emergencies and two non-emergencies (See Table 1). |Bj The temporal behavior of the 
relative call volume AV/ (Vnormai) of the events shown in A, where AV = Vevent - (Kormai), Kvent 
is the call volume on the day of the event (shown in red in A), and (Vnormai) is the average call 
volume during the same period of the week (the call volume during the previous week is shown in 
black in B). |Cj The relative change in the average number of calls placed per user (p) and the total 
number of users (A^) making calls from the region indicates that the call anomaly is primarily due 
to a significant increase in the number of users that place calls during the events. 
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The spatial impact of an emergency. |a| Maps of total anomalous call activity (activity during 
the event minus expected normal activity) for two-hour periods before (-2 < t < 0), during 
(0 < t < 2), and after (2 < t < 4) the bombing. The color code corresponds to the total change 
where the sum runs over the particular time period. |Bj Changes in call volume in regions 
at various distances r from the event epicenter. Note that the peak of the call volume anomaly for 
the bombing within the observed 1 < r < 5 km region is delayed by approximately 10 minutes 
compared to the r < 1 km epicenter region. No call anomaly is observed for r > 10 km. The 
earthquake covers a large spatial range so we instead choose three event regions A-C, at distances 
of 310 km, 340 km, and 425 km from the seismic epicenter (which was outside the studied region). 
im To measure the distance dependence of the anomaly, we computed the total anomalous call 
volume in |B] before (At < t < 0) and after (0 < t < At) each event as a function of the distance 
r, revealing approximately exponential decay, AV(r) ~ exp (-r/rc). Non-emergencies are spatially 
localized, with r^. < 2 km. 
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Social characteristics of information cascades. |a| Changes in call volume for users directly 
affected by the event (Go), users that receive calls from Go but are not near the event (Gi), users 
contacted by G[ but not in Gi or Go (G2), etc. For the bombing and plane crash, populations 
respond very rapidly, within minutes. |Bj The total amount of anomalous call activity in |A] before 
(during -At < t < 0) and after (during < t < At) the event for each user group G, quantifies the 
impact on the social network. We see that information propagates deeply into the social network 
for the bombing and plane crash. [C], Top panel: the contact network formed between affected 
users during the bombing. Bottom panel: the call pattern between users that are active during the 
emergency during the previous week, indicating that the information cascade observed during the 
bombing is out of the ordinary. |D| The distribution of shortest paths within the contact network 
quantifies the anomalous information cascade induced by the bombing. 
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Analyzing a composite event (evacuation preceding an explosion). |A] Call activity increases 
during the evacuation (-1 < t < 0) but levels off after the initial warning, until the explosion at 
t = causes a much larger increase in call activity. |Bj Spatially, the evacuation causes a sharply 
localized activity spike (fc = 1.6 km), but the explosion increases the spatial extent dramatically 
(rc = 9.0 km). |C]-jD| The evacuation only activates the Gq (eyewitness) and Gi groups, meaning 
that information fails to propagate significantly beyond the initial group and their immediate ties. 
However, the blast not only leads to a further increase in call activity in the Go and Gi groups, but 
also triggers the second neighbors Gi. 
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Systematic response mechanisms during emergencies] Systematic response mechanisms during 
emergencies. [A], The midpoint fraction /^id quantifying the onset speed of anomalous call 
activity (a lower /mid indicates a faster onset). Emergencies display a more abrupt call anomaly 
than non-emergencies, which feature gradual buildups of anomalous call activity. |B], The spatial 
extent of the events, quantified by r^, indicates that non-emergency events are far more centrally 
localized than unexpected emergencies. [C[ The relative cascade size R = N^vent/ (A^normai)> where 
N = Yji \Gi\ is the number of users in the social cascade. |Dj zp = (^evem - (Aiormai)) /o" (^normal), 
where P is the probability of calling an acquaintance and cr(P) is the standard deviation of P. 
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List of Tables 

1 Summary of the studied emergencies and non-emergencies. The columns pro- 
vide the duration of the anomalous call activity (Fig. 1), the spatial decay rate 
(Fig. 2), the number of users in the event population |Go|, and the total size of the 
information cascade 2/ \Gi\ (Fig. 3). Events discussed in the main text are itali- 
cized, the rest are discussed in the supplementary material. 'Jet scare' refers to 
a sonic boom interpreted by the local population and initial media reports as an 
explosion [15] 

B Global Activity Level and stop times for all sixteen events IS13I 



A Dataset 

We use a set of anonymized billing records from a western european mobile phone service provider [[H 
121 HI- The records cover approximately lOM subscribers within a single country over 3 years of 
activity. Each billing record, for voice and text services, contains the unique identifiers of the caller 
placing the call and the callee receiving the call; an identifier for the cellular antenna (tower) that 
handled the call; and the date and time when the call was placed. Coupled with a dataset describing 
the locations (latitude and longitude) of cellular towers, we have the approximate location of the 
caller when placing the call. Unless otherwise noted, a "call" can be either voice or text (SMS, 
MMS, etc.), and "call volume" or "call activity" is both voice calls and text messages. 

After identifying the start time and location of an event, we then scan these billing records to 
determine the activity of nearby users. The mobile phone activity patterns of the affected users 
can then be followed in the weeks preceding or following the event, to provide control or baseline 
behavior. 

Self -reported gender information is available for approximately 90% of subscribers. 



A.l Market share 

These records cover approximately 20% of the country's mobile phone market. However, we also 
possess identification numbers for phones that are outside the provider but that make or receive 
calls to users within the company. While we do not possess any other information about these 
lines, nor anything about their users or calls that are made to other numbers outside the service 
provider, we do have records pertaining to all calls placed to or from these ID numbers involving 
subscribers covered by our dataset. This information was used to study social propagation (see 
Sec.irrTl). 
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B Identifying events 



To find an event in tlie mobile phone data, we need to determine its time and location. We have 
used online news aggregators, particularly the local news . google . com service to search for news 
stories covering the country and time frame of the dataset. Keywords such as 'storm', 'emergency', 
'concert', etc. were used to find potential news stories. Important events such as bombings and 
earthquakes are prominently covered in the media and are easy to find. Study of these reports, 
which often included photographs of the affected area, typically yields precise times and locations 
for the events. Reports would occasionally conflict about specific details, but this was rare. We 
take the reported start time of the event as ? = 0. 

Most events are spatially localized, so it is important to consider only the immediate event 
region. Otherwise, the event signal is masked by normal activity (Fig. |A]). The local event region 
can be estimated as a circle centered on the identified epicenter with a radius chosen based on r^. 
For the blackout, however, we chose all towers within the affected city (contained within the city's 
postal codes). 

To identify the beginning and the end of an event, ?start and ?stop, we adopt the following pro- 
cedure. First, identify the event region (a rough estimate is sufficient) and scan all its calls during 
a large time period covering the event (e.g., a full day), giving Vevent(0- Then, scan calls for a 
number of "normal" periods, those modulo one week from the event period, exploiting the weekly 
periodicity of V{t). These normal periods' time series are averaged to give (Vnormai)- (To smooth 
time series, we typically bin them into 5-10 minute intervals.) The standard deviation cr (ynormai) as 
a function of time is then used to compute z{t) = AV (t) / cr (Vnomiai)- Finally, we define the interval 
(^start, ^stop) as the longest contiguous run of time intervals where z(t) > Zthr, for some fixed cutoff 
Zthr- We chose Zthr = 1-5 for all events. 

Finally, there is also the concern that an emergency may be so severe that it interferes with the 
operations of the mobile phone system itself. Only the blackout caused any damage to the mobile 
phone system, where some towers were temporarily disabled. (No calls appear to have been lost 
as other towers picked up the slack.) See Fig.|Bj Likewise, no towers reached maximum capacity, 
preventing important calls from being routed. Such effects may occur during larger, more serious 
emergencies. 

B.l Missing events 

It is possibile that newsworthy events may not be discoverable using mobile phones. Indeed, while 
there are sixteen events documented in main text Table 1 , there were a number of events discovered 
in news reports that we could not identify in the data. The majority of these were forest fires. While 
they affected large regions and numbers of people, we could not find them with mobile phones. A 
large wind storm and a gas main explosion were also not confirmed; both occurred late at night. 
Two other events, a chemical leak causing an evacuation and a fire at a remote factory causing 
noxious fumes were discovered in the dataset, but the affected populations were very small, so we 
decided to discount them. 

The absence of these events in the dataset provides important information about the strengths 
and weaknesses of using mobile phones to study emergencies. Since they rely on user activity. 
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Figure A: Regional and national visibility of events. On a national level (a-c), the spike in call activity 
due to the bombing is lost, but it clearly emerges when we focus only on the immediately local vicinity of 
the event (d-f). The strong weekly periodicity in V{t) is also visible. 
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Figure B: Spatial changes in call activity due to the blackout. We integrate call activity V{t) over two 
time windows before and after the blackout occurs (left, shaded). Studying total call load spatially we see 
a nonlinear response, with a region near the city center (star) suffering a drop in calls due to the blackout 
(right). This region is surrounded by areas that display a significant increase in calls, implying that most 
load was shifted onto nearby cell towers and was not lost. 



events that occur late at night, when most people are asleep, may be difficult to study. Likewise, 
events that are severe but diffuse, providing a slight effect over a very broad area, may not be 
distinguishable from the background of normal activity (although the earthquake is an exception 
to this). Events in remote locations with little cellular coverage will also be more difficult to study 
than events in well-covered and well-populated regions. 

Finally, since we are especially interested in studying how information propagates socially, we 
avoided national events, such as televised sports matches or popular public holidays, as these make 
distinguishing the different event populations G, unreliable. 
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C Source of call anomaly 



The anomalous call activity raises an important question: is the observed spike due to individu- 
als who normally do not use their phone in the event region and now suddenly choose to place 
calls, or are those who normally use their phone in the respective timeframe prompted to call more 
frequently than under normal circumstances? We determined in the event region (i) the relative 
change in the average number of calls placed per user, Apl (pnormai), and (ii) the relative increase 
in the number of individuals that use their phone in this period AN/ (Abnormal)- Figure ?? shows that 
during the bombing we see a 36% increase in phone usage whereas the number of individuals that 
make a call increases by 232%. Other emergencies show a similar pattern: the plane crash, earth- 
quake and blackout show increases in p (A^) of 21% (67.5%), 1.36% (17.4%) and 4.97% (20.8%), 
respectively. Taken together, these results indicate that the primary source of the observed call 
anomaly is a sudden increase of calls by individuals who would normally not use their phone 
during the emergency period, a behavioral change triggered by the witnessed event. 



D Whom do people call 

To see if affected users tend to call existing friends or contact strangers, we measured the proba- 
bility P for a user in Go to make his first call between fstan and ?stop to a friend, where 'friends' are 
the set of individuals that have had phone contact with the Go user during the previous full three 
months (not including the month of the event). Computing the mean and standard deviation of P 
over normal time periods (all weekdays of the month of the event, except the day of the event) 
allows us to quantify the relative change during the event with 

P event (^normal) 

Zf = 7^ ^ ■ (SI) 

C" V^normal/ 

In all emergencies we observe an increase in the number of calls placed to friends (and a corre- 
sponding decrease in calls to non- friends). Many non-emergencies show the opposite trend: users 
are less likely to call a friend, although this change is seldom large. See Sec.[G]and Fig. 5d. 



E Gender response during events 

To investigate how the population response to events depends on demographic factors, we used 
the self-reported gender information, available for the majority (~88%) of the users. For each 
event we compute the significance Zfemaie and Zmaie in the fraction of female and male users active 
during the event, compared with normal time periods, as described in|D} for both directly affected 
users (Go) and those one step away (Gi). As shown in Fig. |Cj we see that nearly all emergencies 
cause an increase in the fraction of affected female users; this increase is significant for half of 
the emergencies. Non-emergencies do not result in deviations in the gender breakdown of affected 
populations. These results hold for both the directly affected users and their neighbors one step 
away. 
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Figure C: Gender response during emergency and non-emergency events. For each event we compute 
the significance Zfemaie and Zmaie in the fraction of female and male users active during the event, compared 
with normal time periods, for both directly affected users (Go) and those one step away (Gi). We see that 
nearly all emergencies cause an increase in the fraction of affected female users; this increase is significant 
for half of the emergencies. Non-emergencies do not result in deviations in the gender breakdown of affected 
populations. 
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Figure D: Voice and text usages during emergencies. Most events do not show a significant change in 
the fraction of voice calls compared to text messages. The earthquake and blackout are exceptions, as is the 
plane crash and festival 3 (Gi only). 

F Voice versus text usage during events 

Similar to the quantities zf and Zfemaie, we can assess whether users have changed their means of 
communication due to an event. To do so we compute the significance Zvoice of the fraction of voice 
calls compared to text messages during the event, for both populations Go and Gi (Fig. |D]). The 
earthquake and blackout give significantly increased text usage while the plane crash shows an 
increase in voice, while most other events do not show a significant change. Since the earthquake 
and blackout were both relatively minor (low danger) events, this result implies that a spike in 
primarily text messaging activity may indicate that the event is a low-threat/non-critical emergency. 

G Systematic response mechanisms during emergencies 

As mentioned in the main text, to summarize our current understanding of these events, we com- 
puted temporal, spatial, and social properties for each anomaly, plotted in main text Fig. 5. Tem- 
porally, we study the midpoint fraction: 



the fraction of time required for half of the anomalous call activity to occur, where tmid satisfies: 



The midpoint fraction is more robust to noisy and non-sharply peaked time series, where estimating 
^peak is difficult, than the peak fraction. Spatially, we use the anomaly's r^. Socially, we compute 
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two quantities: the relative size of the cascade R (the number of people in the event cascade divided 
by the number generated under normal periods; see Sec. H.2 and Fig. |H]) and zf, the significance 
in the probability of calling a friend compared with a non-friend (see Sec.|D]). 

Figure 5 shows a distinct separation in these measures between emergencies and non-emergencies, 
indicating that there are universal response patterns underlying societal dynamics independent of 
the particular event details. 



H Calculating social propagation 

In this section we detail the procedure for extracting the contact network between users after an 



event (Sec. H.l I and how to control for various factors to demonstrate whether or not the contact 



network or its information cascade is anomalous due to the event (Sec. H.2). 



H.l Constructing the time-dependent contact network 

We use the following process to generate the contact network between users due to an event. We 
follow all messages in order of occurrence during the event's time interval [^stan, ^stop]- While we do 
not know the content of the messages, we assume that any related messages do transmit information 
pertaining to the event. A user u who does not know about the event becomes "infected" with 
knowledge due to communication at some time t e [^tartj ^stop if (1) " initiated communication 
from a tower within the event region or (2) u communicated with a user that was already infected. 
We place u in the set Go if u communicated from the event region, otherwise we place u into 
Gi+i where the infected user transmitting knowledge to u was in G;. Following these calls and 
generating the G, with this procedure then forms the contact network. Note that there are two 
types of communications in the dataset, voice and text. We assume that voice is bidirectional 
whereas text messages are not (a user who sends a text message to someone with knowledge of 
the event will learn nothing from that particular communication). An illustration of this process is 
depicted in Fig.|E} 

The contact network itself can be studied using a number of network science tools. One way to 
analyze the size and scale of this network is through the distribution of shortest (or geodesic) path 
lengths [4J. In Fig. ?? we presented the distribution of paths emanating from Go users within the 
giant connected component (GCC) of the bombing's network. One can also analyze the distribution 
for all users, not just Go, and for all components of the network. These possibilities are shown in 
Fig.0 

Finally, the cascade of information through a contact network is a non-local process which may 
be highly effected by sampling/percolation [4J. Indeed, the mobile phone dataset contains only 
users of a single phone company, and a number of propagation paths may be missing. However, 
the dataset actually contains all users who make or receive calls to users within the company, even 
those outside the company. This means we have all cascade paths of one or two steps that begin and 
end with in-company users (regardless of whether they travel through a company user or not) and 
that those paths are the actual shortest paths, providing an effective lower bound on the cascade. 
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Figure E: Extracting the time-dependent contact network from call data. [a| A cartoon example of the 
dataset's call records, representing eiglit calls during 15 minutes following an event. The region of the event 
contains two towers, Tl and T2. Call type is (T) for text message and (V) for voice call. [B], Three instances 
of the evolving contact network, extracted from the example call log shown in a. Two users made calls from 
the region during the first five timesteps, initiating a cascade. 
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Figure F: Distributions of short- 
est paths found within the bomb- 
ing's contact network. One can com- 
pute shortest paths emanating from 
all users (top) or only users in Go 
(bottom) and for paths within the en- 
tire network (left) or only the net- 
work's giant component (right). 
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In other words, if we can demonstrate the existence of a cascade over users {Gq, Gi, G2}, then the 
actual cascade containing those users can only be larger. 



H.2 Controlling for social propagation 

A contact network between users can always be constructed, even when no event takes place. There 
may appear to be propagating cascades as well, since there are temporal correlations between users 
receiving and then placing calls. This must be properly controlled for. 

Suppose we are studying an event and have identified its affected users Go, those users that 
made calls during some time window (t, t + At). We expect that Go users will call other users (GO 
outside the event, Gi users will call G2 users, etc., generating a cascade {Go,Gi, . . .}. Tracking 
calls starting from some G will always generate such groups, even during normal periods. Then 
the question is, do the users in G,, i > show increased activity during an emergency or other 
event? If so, that is evidence of the social propagation of situational awareness. 

To answer this question we need to consider several points: 



Suppose that the total call activity for a region is Vif) (Fig. GA I. Now select a group of users 
G/it that each place at least one call during a small time window At. Tracking only their call 
activity generates the conditional time series V{t\GAt)- This time series has a "selection bias" 
that creates the appearance of a large increase in activity during the time window since all 



the users must place calls then (Fig. GB I. This must be accounted for when studying selected 
users during an event. 

• When tracking V{t\G) for a group of N = \G\ users, the overall level of activity will depend 
on A'^ (Fig. GC[ ). A rescaling is necessary when comparing the activity levels of different size 
groups. 

• The selection bias will also depend on the length of the time window At. If At = 24 hours 
had been used in Fig. |G} no bias would be evident. All events are compared to time periods 
with the same At, so this effect is automatically controlled for. 

Having considered these aspects, we turn our attention to the problem of calculating the cas- 
cade itself. For the event period, tracking the outgoing calls of {Go, Gi, . . .} is straightforward. 
To determine how unusual this activity is, we need controls for comparison. There are several 
possibilities: 

Control 1 One option is scanning the event region during the same time of the week, collecting a 
control population of users, and then following their cascade. However, this does not account 
for changes in the composition or number of users in the event region (some studied events 
were quite remote and typically contained very few users). 

Control 2 Another possibility is to simply follow the activity of the same users G, from the event's 
cascade during normal time periods. This choice is keeps the population unchanged but it 
does not account for changes in who is being called; Go users may have chosen to call very 
different people during an emergency. Further, it does not account for the selection bias that 
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Figure G: Understanding selection bias. |a| The call volume V(t) of a major city during an ordinary 
24-hour period. |b} The call volume V{t\G) of N = 10'* randomly selected users from|A]who all placed one 
or more calls between 12:00 and 14:00 (highlighted). The 'bias' of this conditional time series is clear [C} 
The same as|B]for different values of N. Rescaling by the population size (inset) indicates that the relative 
scale of the bias of V{t\G) during the time window is independent of the population size. 



is present during the event but not during the normal periods, which may exaggerate the 
change in call activity. 

Control 3 Finally, one can study new cascades generated by the same event users Go during nor- 
mal periods, creating a different cascade {Go, ^1,^2. • • •} for each normal period. The activ- 
ities of each G, can then be compared to those of the corresponding ^,'s. This directly tests 
the effect that the initiating population Gq has on the cascade, by studying those cascades the 
population would normally induce, and accounts for selection bias since this bias is present 
during the event and the normal periods. 

We have chosen to use Control 3. Note that G, will typically be larger than the normal ^,'s and 
that G, users may be more active than those in gi, so V(t\gi) must be rescaled when being compared 
to the event's V(t\Gi). To do this, we multiply V(t\gi) by a constant scaling factor a,, 

ai= f V(T\Gi)dT [ V(T\gddT, (S4) 
Jst I Jst 

where both integrals run over the same "calibration interval" 6t and r = is the start of the selection 
window. For most events we integrate over a 24-hour period two days before the window, 6t = 
(-48, -24). If the event is on a weekday, we ensure the calibration interval is not a weekend and 
vice versa. This factor a, was chosen such that the total number of calls during normal time periods 
for V(t\Gi) is approximately equal to a, V(%,), equalizing the smaller time series and removing bias 
due to |G,-| ^ |^,-|. 
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Control 3 and Eq. S4 allow one to compare disparate populations' call activities, but there are 
two subtle yet important details to consider when comparing event and normal contact networks: 

1. The event contact network under Control 3 consists of users |Gq, Gp . . .} while the con- 
tact network for normal period n contains users |Gq, g", • • •}• As shown in Fig. ??, many 
members of G^ will be silent during each period n. This means that the cascade during period 
n is actually generated by a smaller set of users ^q" c Gq, defined as those users in G^ who 
also make calls during period n. The rescaling factors a, account for this when comparing 
activity levels V{t\G) but this may give an unfair advantage to the growth of the event contact 
network, as quantified by the relative cascade size R, when compared to normal periods. For 
example, an event may result in i? > 1 simply because the event period's "seed" population 



is larger than that of the normal period. See Fig. HA 

To control for this effect, we compute Gq for the event and use it to generate g^^!^ for each 
period n. We then return to the original event period and track a new event cascade for 
each ^q". In other words, we consider only the smaller cascade {gQ",^i", . . .} formed by 
following only users who are normally active during that time of day. This means there are 



now different event cascades corresponding to each normal period. See Fig. HB 



2. There is a tendency for non-emergencies to occur later in the day than the emergency events. 
Most concerts are held at night, for example. Users are generally more active during this 
time of day; many users have plans with free nightly minutes. This factor is not an issue for 
activity levels V{t) since these are always compared during the same time of day. However, 
this may give an additional advantage when e.g., comparing R for an event that occurs early 
in the morning to an event that occurs during peak call activity. The latter cascade occurs 
when users are generally more active, increasing the number of potential propagation vectors 
and possibly increasing the rate at which new members are added to the G,'s. 

A simple way to control for this is the following. First, compute the Global Activity Level 
(GAL), the total number of phone calls in the entire dataset during each event's time win- 
dow. Then, pick the event that contains the lowest GAL and shorten all the time windows 
(decreasing ?stop only) for the other events such that they have the same minimum GAL. 
Finally, generate the contact network during these reduced windows only. Doing this guar- 
antees that every event has the same number of possible communications to propagate along. 
This process was used for all computations of R. 

With this machinery in hand, we can now successfully demonstrate that there are anomalously 
large cascades for many emergencies, especially the bombing. Not only is R > \ (Figs. 5c and|H]) 
but the contact populations show anomalous increases in call activity, even after all controls are 
in place (Figs. ??, ??,|L} and Ml. All non-emergencies generate ordinarily- sized contact networks 
(Figs. 5c and|H]) and normal activity levels (Figs. ??, ??,|N| and[0]). 
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Figure H: Controlling factors that affect the 
relative cascade size. |A| Relative cascade size 

R = A^event/ (Abnormal), whcrC A^event ^ 

and (Abnormal) ^ IGgl + <i;/>o |g- 1)„ (averaged 
over normal events n). |B| Relative cascade size 
using/? = {I,i\gf'\/I,j\g"j\),i, controlling for 
the lower activity level during normal period 
n with c Gq. With this control, all non- 
emergencies have R < I and all emergencies 
have R > 1 (Storm 3hasR = 1.0044). 
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Table B: Global Activity Level (GAL) and stop times for all sixteen events, show the original fstop and 
modified t[^^^ that equalizes all events' GAL. Storm 2 had the smallest GAL over the corpus. 
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Figure I: Regional call activity for the eight emergencies analyzed. The first four are also shown in main 
text Fig. ??. Shaded regions indicate ±2 standard deviations. 

I Results on the event corpus 

Sixteen events were identified for this work (see main text Table 1), but six events were focused 
upon in the main text. Here we report the results for all events. In Figs. |I]and|j]we provide the 
call activities V(t) for all sixteen events used in this study (compare to Fig. 1). In Fig.|K]we show 
AV(r) for the ten events not shown in main text Fig. ??. Finally in Figs.|L||M}|N} and[0]we present 
activity levels V(t\Gi) for Go through G3 for all 16 events. 
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Figure J: The same as Fig.|l|for the eight non-emergencies. Concert 3 takes place at an otherwise unpopu- 
lated location and the normal activity is not visible on a scale showing the event activity. 
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Figure K: Spatial call activity for the ten events not shown in main text Fig. ??. 
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Figure L: Social propagation for tlie four main text emergencies. Shown are the activity patterns (condi- 
tional time series) for Go through G3 during the event (black curve) and normally (shaded regions indicate 
±2 s.d.)- Normal activity levels were reseated to account for population and selection bias (see Sec. [H]) The 
bombing and plane crash show increased activities for multiple G, while the earthquake and blackout do not. 
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Figure M: Same as Fig. L for the remaining emergency events. 
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Figure N: Same as Fig.|L]for tlie concerts. All concerts show extra activity only for Go except Concert 4, 
which shows a small increase in activity for Gi several hours after the concert started. 
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Figure O: Same as Fig.|L|for the festivals. Interestingly, Festival 2 shows no extra activity, even for Go, 
indicating that the call anomaly for those events was caused only by a greater-than-expected number of users 
all making an expected number of calls. 
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